Perplexity SPACE is now open source, which means any developer can run the same sandbox Perplexity uses to keep its AI agents contained. Perplexity announced it on October 15, 2026, and the code is on GitHub. If you build or run AI agents, this gives you a tested way to let them execute code without handing them your machine.
Here are the facts you can check in a minute.
- Announced: October 15, 2026, in Perplexity’s official blog post.
- What it is: the sandbox platform behind Perplexity Computer, its agent product.
- Where to get it: github.com/perplexityai/SPACE, with docs at space.docs.perplexity.ai.
- Cloud partners: Akamai, Crusoe and CoreWeave.
- Speed claim: sandboxes start 3 to 5 times faster than Perplexity’s old provider.
Those partners matter because they hint at where SPACE will show up first: hosted, ready-to-use setups instead of a weekend of DIY.
What Perplexity SPACE actually does
An AI agent that writes and runs code needs somewhere to run it. Running that code on your laptop or production server is risky, since one bad command can touch real files. A sandbox is a walled-off computer where the agent can work freely and break things safely.
SPACE gives each agent its own small virtual machine with its own operating system. A central control plane creates, pauses, resumes and deletes these machines. Perplexity says it has powered every Computer session since July and creates millions of sandboxes per day.
Why the agent never holds your passwords
The design choice worth noticing is that SPACE treats the sandbox as untrusted. Network access and credentials are managed outside it. So an agent can reach an approved service without ever storing the login in its own environment.
That matters because prompt injection is the usual way agents get tricked. If a hostile web page hijacks an agent, there is no key in the sandbox for it to steal. We covered a related defense in Nvidia’s NXDirection prompt injection research, and the two ideas fit together well.
Pause, resume and branch: the developer features
Beyond isolation, SPACE is built for long jobs that get interrupted. The platform supports these abilities.
- Pause and resume a sandbox without losing work.
- Frequent file snapshots and full-environment checkpoints.
- Session branching, so you can try two paths from the same starting point.
- Storing only changes rather than full copies, which makes creating or restoring a sandbox cheaper.
Branching is the quiet winner. An agent can attempt a risky fix, and if it fails you roll back to the checkpoint in seconds.
How tough is the Perplexity SPACE sandbox?
Perplexity let AI agents attack the sandbox on purpose. Its published results reported no escape from the virtual machine to the host in 108 attempts. Some agents did find ways around the network restrictions, though.
Perplexity says it fixed those weaknesses and that neither attack method worked in follow-up testing. It also says it reported related issues found in other sandbox platforms to their vendors. Treat this as the company’s own testing, not an independent audit. Some outlets quote different attempt counts, so we used the figure from Perplexity’s post.
Where you can run it today
Three infrastructure companies are already involved, at different stages.
| Provider | Status (per Perplexity) |
|---|---|
| Akamai | Tested SPACE and launched it on its cloud platform; working on customer availability |
| Crusoe | Adding SPACE to its Managed AI Services |
| CoreWeave | Published setup guidance for evaluating SPACE on its CKS platform |
The announcement post does not state the license, so read the repository before using SPACE in a product. If you want to see how agents are also being used to fix code, our piece on GitHub Agentic Autofix shows the other side of the same trend.
What this means if you are not a developer
You may never install SPACE yourself, but you will likely feel its effects. Agent products from many companies need a safe place to run tasks like booking, research or spreadsheet work. A free, inspectable sandbox lowers the cost of doing that well.
Perplexity also argues that open code helps because more people can look for flaws. That is a fair point, though open code only helps if people actually review it. Faster sandbox start-up could also make agent tools feel snappier, since less time goes to waiting for a fresh environment.
The bigger shift is cultural. A year ago, most agent sandboxes were closed commercial services. Now one of the busiest ones is public, which gives smaller teams a real starting point instead of a blank page.
Frequently Asked Questions
Is Perplexity SPACE free to use?
The code is open source and public on GitHub. Check the repository for the exact license terms, since the announcement does not spell them out. Running it on a cloud provider will still cost compute.
Do I need a Perplexity account to use SPACE?
Nothing in the announcement says you do. It is released as a platform you can deploy yourself or through partners like Akamai and Crusoe.
What is an AI agent sandbox?
It is an isolated virtual computer where an agent can run code and use tools. If something goes wrong, the damage stays inside the sandbox.
Is it safe against escapes?
Perplexity reported no VM-to-host escape in 108 test attempts, and fixed the network bypasses it found. That is encouraging, but it is the company’s own testing.
Our take
If you build agents, SPACE is worth an afternoon of testing, mainly for the credential design and the checkpointing. If you only use AI tools, you will not touch it directly, but it signals that serious agent makers now treat safe execution as a shared problem. Wait for the license check and independent reviews before betting a product on it.
Leave a Reply